From 5b00a4c89d372debfd73dd4e6977fdf08b39737a Mon Sep 17 00:00:00 2001 From: root Date: Thu, 3 Jun 2021 15:24:00 +0000 Subject: [PATCH] Added detection testing service results inDetect SharpHound File Modifications --- .../detect_sharphound_file_modifications.yml | 54 +++++++++++-------- 1 file changed, 33 insertions(+), 21 deletions(-) diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index a8311eb140..f8595c2a4d 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -6,32 +6,43 @@ author: Michael Haag, Splunk type: batch datamodel: - Endpoint -description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following a typical pattern that is often not changed. - This analytic focuses on the default file name scheme. Note that this may be evaded with different parameters within SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` are two examples. In addition, executing SharpHound via .exe or .ps1 without any command-line arguments will still perform activity and dump output to the default filename. - Example default filename `20210601181553_BloodHound.zip`. - SharpHound creates multiple temp files following the same pattern `20210601182121_computers.json`, `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, or remove these json's entirely if it is too noisy. - During traige, review parallel processes for further suspicious behavior. Typically, the process executing the `.ps1` ingestor will be PowerShell. +description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. + SharpHound will query the domain controller and begin gathering all the data related + to the domain and trusts. For output, it will drop a .zip file upon completion following + a typical pattern that is often not changed. This analytic focuses on the default + file name scheme. Note that this may be evaded with different parameters within + SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` + are two examples. In addition, executing SharpHound via .exe or .ps1 without any + command-line arguments will still perform activity and dump output to the default + filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates + multiple temp files following the same pattern `20210601182121_computers.json`, + `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, + or remove these json's entirely if it is too noisy. During traige, review parallel + processes for further suspicious behavior. Typically, the process executing the + `.ps1` ingestor will be PowerShell. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip", "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json") - by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest - | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `detect_sharphound_file_modifications_filter`' + as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip", + "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json") + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path + Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `detect_sharphound_file_modifications_filter`' how_to_implement: To successfully implement this search you need to be ingesting information - on file modifications that include the name of the process, and file, responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -known_false_positives: False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed. + on file modifications that include the name of the process, and file, responsible + for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` + node. +known_false_positives: False positives should be limited as the analytic is specific + to a filename with extension .zip. Filter as needed. references: - - https://attack.mitre.org/software/S0521/ - - https://thedfirreport.com/?s=bloodhound - - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors - - https://github.com/BloodHoundAD/SharpHound3 - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk +- https://attack.mitre.org/software/S0521/ +- https://thedfirreport.com/?s=bloodhound +- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors +- https://github.com/BloodHoundAD/SharpHound3 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk tags: analytic_story: - Discovery Techniques - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log kill_chain_phases: - Reconnaissance mitre_attack_id: @@ -51,4 +62,5 @@ tags: - file_name - process_id - file_create_time - security_domain: endpoint \ No newline at end of file + security_domain: endpoint + automated_detection_testing: passed